Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS)334 questions across 34 pages are complete and free, with no account or card.
334 questions in this bank
Free access · progress saved on this device
Refer to the exhibit. An analyst received this alert from the Cisco ASA device, and numerous activity logs were produced. How should this type of evidence be categorized?
Answer: C
not sure how this is best evidence for attribution.. A & B are the same thing indirect = circumstantial so they have to eliminated. That leaves answer C for corroborative.
Source: Adapted from community discussion — trigger4848
Refer to the exhibit. Which piece of information is needed to search for additional downloads of this file by other hosts?
Answer: D
Copying will change a file's system metadata values, including its location, creation data and last accessed date, but as these are all stored outside of the file, the hash shouldn't change. Therefore, searching for the File Hash Value on other hosts will let you know if the file has been downloaded on other hosts.
Source: Adapted from community discussion — SecurityGuy
What is the difference between mandatory access control (MAC) and discretionary access control (DAC)?
Answer: B
B is correct, MAC is considered the strictest level of access controll where information is classified in levels and users are given certain levels. With DAC the permissions are tied to an object and they are set by the owner.
Source: Adapted from community discussion — Leo_Visser
An organization's security team has detected network spikes coming from the internal network. An investigation has concluded that the spike in traffic was from intensive network scanning. How should the analyst collect the traffic to isolate the suspicious host?
Answer: B
Which technology on a host is used to isolate a running application from other application?
Answer: D
Reference: https://searchsecurity.techtarget.com/definition/sandbox#:~:text=Sandboxes%20can%20be%20used%20to,be%20run%20inside%20a%20sandbox
Source: Adapted from community discussion — AhmedAbdalla
Refer to the exhibit. Which type of attack is being executed?
Answer: C
Reference: https://www.w3schools.com/sql/sql_injection.asp
Source: Adapted from community discussion — AhmedAbdalla
What is a difference between inline traffic interrogation and traffic mirroring?
Answer: A
Yes A should be the answer. Inline traffic interrogation analyzes traffic in real time and has the ability to prevent certain traffic from being forwarded Traffic mirroring doesn't pass the live traffic instead it copies traffic from one or more source ports and sends the copied traffic to one or more destinations for analysis by a network analyzer or other monitoring device
Source: Adapted from community discussion — beowolf
A system administrator is ensuring that specific registry information is accurate. Which type of configuration information does the HKEY_LOCAL_MACHINE hive contain?
Answer: B
Refer to the exhibit. Which packet contains a file that is extractable within Wireshark?
Answer: D
Moderator - please strike my previous comment. Packet 2318 is just the request for the file. There is indication of a gif in the 2542 packet.
Source: Adapted from community discussion — qz999
Which regex matches only on all lowercase letters?
Answer: A
"A" is correct Again in greek for me. The correct question: Which regex matches only on all lowercase letters? A. [a-z]+ <-- a sequence of letters in lower case B. [^a-z]+ <-- NOT a sequence of letters in lower case C. a-z+ <-- a sequence of "a-z" word D. a*z+ <-- exclude "a" finds "z"
Source: Adapted from community discussion — anonymous1966
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
200-201 practice, question 21. 334 questions available.
Version 1.0.0. How we source questions